HouseFuzz/reports

GitHub

github.com

Releases0

Stars3

CVE reports

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2024-42740 ↗	Aug 13, 2024Tuesday, 13 August 2024, 14:15	6.8 MEDIUM	—
In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setLedCfg. Authenticated Attackers can send malicious packet to execute arbitrary commands.
CVE-2024-42737 ↗	Aug 13, 2024Tuesday, 13 August 2024, 14:15	8.8 HIGH	—
In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in delBlacklist. Authenticated Attackers can send malicious packet to execute arbitrary commands.
CVE-2024-42736 ↗	Aug 13, 2024Tuesday, 13 August 2024, 14:15	7.8 HIGH	—
In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in addBlacklist. Authenticated Attackers can send malicious packet to execute arbitrary commands.
CVE-2024-42738 ↗	Aug 13, 2024Tuesday, 13 August 2024, 14:15	8.8 HIGH	—
In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setDmzCfg. Authenticated Attackers can send malicious packet to execute arbitrary commands.
CVE-2024-42739 ↗	Aug 13, 2024Tuesday, 13 August 2024, 14:15	8.8 HIGH	—
In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setAccessDeviceCfg. Authenticated Attackers can send malicious packet to execute arbitrary commands.
CVE-2024-42743 ↗	Aug 12, 2024Monday, 12 August 2024, 20:15	8.8 HIGH	—
In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setSyslogCfg . Authenticated Attackers can send malicious packet to execute arbitrary commands.
CVE-2024-42744 ↗	Aug 12, 2024Monday, 12 August 2024, 20:15	8.8 HIGH	—
In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setModifyVpnUser. Authenticated Attackers can send malicious packet to execute arbitrary commands.
CVE-2024-42745 ↗	Aug 12, 2024Monday, 12 August 2024, 20:15	8.8 HIGH	—
In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setUPnPCfg. Authenticated Attackers can send malicious packet to execute arbitrary commands.
CVE-2024-42747 ↗	Aug 12, 2024Monday, 12 August 2024, 20:15	8.8 HIGH	—
In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setWanIeCfg. Authenticated Attackers can send malicious packet to execute arbitrary commands.
CVE-2024-42748 ↗	Aug 12, 2024Monday, 12 August 2024, 20:15	8.8 HIGH	—
In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setWiFiWpsCfg. Authenticated Attackers can send malicious packet to execute arbitrary commands.
CVE-2024-42741 ↗	Aug 12, 2024Monday, 12 August 2024, 20:15	8.8 HIGH	—
In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setL2tpServerCfg. Authenticated Attackers can send malicious packet to execute arbitrary commands.
CVE-2024-42742 ↗	Aug 12, 2024Monday, 12 August 2024, 20:15	8.8 HIGH	—
In TOTOLINK X5000r v9.1.0cu.2350_b20230313, the file /cgi-bin/cstecgi.cgi contains an OS command injection vulnerability in setUrlFilterRules. Authenticated Attackers can send malicious packet to execute arbitrary commands.
CVE-2024-36728 ↗	Jun 3, 2024Monday, 3 June 2024, 14:15	8.1 HIGH	—
TRENDnet TEW-827DRU devices through 2.06B04 contain a stack-based buffer overflow in the ssi binary. The overflow allows an authenticated user to execute arbitrary code by POSTing to apply.cgi via the action vlan_setting with a sufficiently long dns1 or dns 2 key.
CVE-2024-36729 ↗	Jun 3, 2024Monday, 3 June 2024, 14:15	6.3 MEDIUM	—
TRENDnet TEW-827DRU devices through 2.06B04 contain a stack-based buffer overflow in the ssi binary. The overflow allows an authenticated user to execute arbitrary code by POSTing to apply.cgi via the action wizard_ipv6 with a sufficiently long reboot_type key.